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PATENT 

ATTORNEY DOCKET NO: 10360/021001 

LINKS FOR CONFIGURING A VIRTUAL PRIVATE NETWORK 

Background ^ 
5 • This invention relates particularly to providing 

links for configuring a virtual private network. 

LANs (Local Area Networks) , Intranets, and other 
private networks interconnect user computers, file servers, 
e-mail servers, databases, and other resources. Typically, 

10 organizations want to offer remote access to private network 
resources to traveling employees, employees working at home, 
and branch offices without compromising the security of the ■ 
private network. 

Virtual private networks (a.k.a. Extranets) securely 

15 stitch together remote private networks and remote computers 
using a public network such as the Internet as a 
communication medium. Each private network can connect to 
the public network via an extranet switch such as the 
Contivity™ Extranet switch offered by Nortel™ Networks. 

20 Extranet switches provide a variety of virtual private 
network functions such as network packet tunneling and 
authentication. 

For configuring the functions provided by the 
switch, Contivity™ switches offer a web-server and web-pages 

25 programmed to configure the different virtual private 

network functions in response to administrator interaction 
with the web-pages. By using a browser to navigate to each 
virtual private network switch, one after another, the 
administrator can configure the tunneling, authentication, 

30 packet filtering, and other functions provided by the 
switch. Management functions provided by the Contivity™ 
switches are described in greater detail in the New Oak™ 
Communications Extranet Access Switch Administrator ' s Guide. 



Summary of the Invention 
In general, in one aspect, a method of managing a 
virtual private' network includes providing a graphical user 
interface configured to display at least one link for each 
5 of a plurality of computers offering virtual private network 
functions. 

Embodiments may include one or more of the following 
featuers. The computers may be extranet switches. The 
links may be HTTP (HyperText Transfer Protocol) links. The 

10 links may link to information describing users of the 

virtual private network functions provided by the computers, 
packet filters provided by the computers, and/or computer 
access hours. The method may further include transmitting 
an HTTP request in response to selection of a link. 

15 The method may further include providing a list of 

the computers offering virtual private network functions -in 
the same display as a link. The link displayed may 
correspond to a computer selected from the list of computers 
offering virtual private network functions. - 

20 In general, in another aspect, a method of managing 

a virtual private network includes providing a graphical 
user interface display that includes a list of extranet 
switches offering virtual private network functions, and a 
collection of HTTP links for an extranet switch selected 

25 from the list, the links causing transmission of an HTTP 
request . 

In general, in another aspect, the invention 
features a 

computer program product, disposed on a computer readable 
30 medium, for managing a virtual private network. The program 
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includes instructions for causing a processor to provide a 
graphical user interface configured to display at least one 
link for each of a plurality of computers offering virtual 
private network functions. 
5 In general, in another aspect, the invention 

features a computer program product, disposed on a computer 
readable medium, for managing a virtual private network. 
The program includes instructions for causing a processor to 
provide a graphical user interface display that includes a 

10 list of extranet switches offering virtual private network 
functions, and a collection of HTTP links for an extranet 
switch selected from the list, the links causing 
transmission of an HTTP request. 

Advantages may include one or more of the following. 

15 By providing links corresponding to different 

computers providing virtual private network functions, an 
administrator can quickly access a desired page on any 
particular computer. The administrator can also quickly 
access the same page (e.g., the users page) on a variety of 

20 different switches, one after another. Additionally, the 
links obviate the need to remember the different URLs of the 
different computers offering virtual private network 
functions. 

Other advantages of the invention will become 
25 apparent in view of the following description, including the 
figures, and the claims. 

Brief Description of the Drawings 
FIG." 1 is a diagram illustrating bulk configuration 
30 of multiple extranet switches. 
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FIG. 2 is a diagram of tunnels provided by 
configured extranet switches. 

FIG. 3 is a flow-chart of a process for bulk 
configuring multiple extranet switches. 
5 FIG. 4 is a diagram of a switch manager exporting 

configuration information to multiple extranet switches. 

FIGS. 5-13 are screenshots of a wizard that guides 
an administrator through a bulk configuration process 

FIG. 14 is a diagram illustrating importing 
10 information from multiple extranet switches. 

FIG. 15 is a diagram of a switch manager importing 
information from an extranet switch. 

FIGS. 16-20 are screenshots of extranet switch 
reports. 

is FIGS. 21-31 are screenshots of a graphical user 

interface that enables an administrator to manage extranet 

switches in a virtual private network. 

FIG. 32 is a screenshot of a menu of links to 

web-pages offered by an extranet switch. 
20 FIGS. 33-3 9 are screenshots of web-pages offered by 

an extranet switch. 

Description of the Preferred Embodiments 

25 

Introduction 

An extranet switch manager provides administrators 
with a tool that centralizes management of different 
extranet switches in a virtual private network. The manager 
30 can bulk configure multiple extranet switches, prepare 
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reports describing the extranet switches, provide convenient 
access to individual switch configuration mechanisms, and 
provide an intuitive representation of virtual private 
network elements. The manager offers these capabilities to 
.5 an administrator via an easy to use graphical user interface 
(GUI) . After an administrator enters IP (Internet Protocol) 
addresses of extranet switches, in a virtual private network, 
the switch manager can quickly import and export data to 
both view the current configuration and activity of the 
10 switches and quickly alter the configuration of t one or more 
switches . 

Bulk Configuration of Multiple Extranet Switches 

As shown in FIG. 1, a virtual private network 102 

is can include private networks 106, 110 and/or remote 

computers 114 that communicate over a public network 104. 
Each private network 106, 110 can connect to the public 
network 104 via an extranet switch 100a,. 100b such as a 
Contivity™ Extranet Switch offered by Nortel Networks. As 

20 shown, each extranet switch 100a, 100b has a private 

interface that communicates with a private network 106, 110 
and a public interface that communicates with the public 
network 104. Extranet switches 100a, 100b handle virtual 
private network functions such as network packet tunneling 

25 and authentication. The extranet switches 100a, 100b can 
also enforce packet filtering rules, enforce hours of 
access, and perform other functions that maintain a secure 
virtual private network. Many of these functions may be 
included in a firewall or* router. Hence, we use the term 

30 "extranet switch" to generically refer to a system providing 
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these functions. As shown in FIG. 1, switch manager 
instructions 116 reside on a remote computer, however, the 
instructions 116 could reside on any computer able to 
communicate with the extranet switches 100a, 100b. 

.5 Each switch 100a, 110b can provide different 

tunneling protocols (e.g., PPTP (Point-to-Point Tunneling 
Protocol), L2F (Layer 2 Forwarding), L2TP (Layer 2 Tunnel 
Protocol), and IPSec (IP Secure)), different encryption 
schemes, different authentication mechanisms (e.g., internal 

10 or external LDAP (Lightweight Directory Access Protocol) and 
RADIUS (Remote Authentication Dial-In User Service)), and 
different packet filtering schemes (e.g., filtering based on 
the direction of communication, the source and/or 
destination of a packet, and/or the type of TCP (Transfer 

15 Control Protocol) connection established) . As shown in FIG. 
1, switch manager instructions 116 enable an administrator 
to quickly configure multiple switches 100a, 100b to share a 
set of common characteristics (e.g., the same authentication 
scheme and the same tunneling protocols) by transmitting the 

20 same configuration information 118a, 118b to each switch 
100a, 100b. 

Referring to FIG. 2, after being configured, the 
virtual private network 102 permits secure communication 
between private, networks 106, 110. For example, a computer 

25 112 on a first private network 110 can securely send network 
packets to a computer 108 on a second private network 106 by 
tunneling 120 through the public network 104. An extranet 
switch 100a receiving a packet prior to transmission over 
the public network 104 can provide a tunnel 120 by 

30 encrypting and/or encapsulating the network packet. 
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Encryption encodes packet contents to prevent computers on 
'* the public network from reading the original contents. 
Encapsulation generates a new packet addressed to the 
extranet switch 100b at the end of the tunnel 12 0 and 
5 includes the original packet as the contents of the new 
packet. By analogy, encapsulation is like placing a mail 
envelope in a bigger envelope with a different mail address. 
Encapsulation prevents computers- on the public network 104 
from identifying the addresses of private network 106, 110 

10 resources. 

When the extranet switch 100b at the end of the 
tunnel 120 receives a packet, the extranet switch 100b can 
decrypt and de-encapsulate the packet for delivery to its 
destination 108. The second extranet switch 100b can also 

is authenticate information received from the first extranet 
switch 100b to make sure a would-be intruder is not 
masquerading as a member of the virtual private network 102 . 

As shown, a switch 100a can also provide tunnels for 
a remote user 114 connected to the public network 104. For 

20 example, an employee can access private network 110 
resources by connecting to an ISP (Internet Service 
Provider) and establishing a tunnel 122 with an extranet 
switch 100a. Again, the extranet switch 100a can 
authenticate the identity of the remote user 114 to prevent 

25 unauthorized access to the private network 110. 

The extranet switch 100a can also connect tunnels. 
For example, if so configured, the switch could connect 124 
tunnels 120 and 122. to enable the remote user .114 to also 
access resources on private network 106 via tunnels 122 and 

30 120. 
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Referring to FIG. 3, switch manager instructions 116 
receive 126 information specifying the configuration of 
multiple extranet switches. The bulk configuration 
information can be specified by a user, provided by a 
5 program that automatically configures switches, or copied 
from configuration information of a previously configured 
switch. After receiving 126 the configuration information, 
the switch manager instructions 116 transmit 128 data and/or 
instructions corresponding to the received configuration 

10 information to the extranet switches. Each extranet switch 
processes 130a, 130b the transmitted information to change 
its configuration in accordance with the transmitted 
, . information. 

Referring to FIG. 4, an extranet switch 100a, 100b. 

15 includes software and/or firmware instructions 130a, 130b 
that handle switch functions. Such functions can include 
authentication 132a, tunnel management 134a, packet 
filtering 136a, etc. Each switch 100a, 100b can also 
include a script interface 138a that processes script 

20 commands. For example, a script command of "call omSET 

using ( " trustedFTPenabled" "ENABLED" ) 11 configures the switch 
to allow processing of FTP (File Transfer Protocol) requests 
from trusted computers: 

In one implementation, switch manager instructions 

25 116 include instructions for a graphical user interface 144 
(GUI) , a script interface 140, and configuration 142 
instructions that model the extranet switches and coordinate 
the exchange of information between the GUI 144 and the 
script interface 140. When a user specifies bulk 

30 configuration information via the. GUI 14 6, the script 
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interface 142 produces a script 118a, 118b that includes 
script commands for configuring the switches in accordance 
with the user specified information. Appendix A includes a 
sample configuring script. In the implementation described 
5 above, the switch manager 116 can export the configuration 
information 118a, 118b to extranet switches by transmitting 
the information 118a, 118b to a pre-determined switch 
directory via FTP (File Transfer Protocol) . The script 
interface 138a, 138b on the switches 100a, 100b detect and 

10 process the script upon its arrival. 

The exporting technique described above is merely 
illustrative and a wide variety of other techniques could be 
used to coordinate communication between a computer 
executing switch manager instructions 116 and the different 

15 extranet switches 100a, 100b. For example, the 

communication need not use FTP nor need the information take 
the form of a script . 

Referring to FIG. 5, the GUI provides a wizard 
(e.g., Bulk Configure Extranet Switches) that enables an 

20 administrator to bulk configure multiple extranet switches 
by interacting with a preprogrammed series of dialogs. The 
dialogs query an administrator for different sets of switch 
characteristics. The preprogrammed set of dialogs reduces' 
the chances an administrator will forget to configure a 

25 particular set of switch characteristics. 

Referring to FIG. 6, after invoking the bulk 
configuration wizard, an administrator can select one or 
more extranet switches to bulk configure. The manager will 
transmit configuration information only to the selected 

30 switches. 
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Referring to FIG. 7, the wizard permits an 
administrator to configure the selected switches to provide 
an account to a particular administrator. Since a single 
administrator may be in charge of all the switches in a 
5 virtual private network, establishment of an identical 

administrator account on the different switches enables the 
administrator to quickly login to the different switches 
using the same id and password. 

Referring to FIG. 8, each switch may be individually 

10 configured to have a unique hostname (e.g., "NOC2000 " ) . An 
administrator can bulk configure different switches to have 
the same DNS (domain name service) domain such as 
"myVPN.com" . By defining a common domain for multiple 
switches, an administrator can thereafter refer to a 

15 particular switch by combining the domain name and the 
hostname (e.g., "myVPN.com/NOC2000"). Primary and backup 
DNS servers can translate the domain and hostname to a 
particular IP (Internet Protocol) address. Thus, by 
specifying a common domain, the administrator can identify a 

20 switch by a memorable text entry instead of a more cryptic 
IP address (e.g., "255.255.68.28"). 

Referring to FIG. 9, an administrator can configure 
the services offered by the switches. For example, the 
administrator can enable or disable different tunnel 

25 protocols (e.g. , IPSec, PPTP, LT2P, and L2F) . The GUI also 
gives the administrator the ability to enable or disable 
tunneling sessions initiated from within the private network 
served by a switch and tunneling sessions initiated from a 
source outside the private network (e.g., "public" tunnels). 



- 10 - 



The administrator can also enable or disable 
different communication protocols such as HTTP (HyperText 
Transfer Protocol), SNMP (Simple Network Management 
Protocol) , FTP (File Transfer Protocol) , and TELNET. 
5 Additionally, the manager gives the administrator the 

ability to control the types of communication allowed. For 
example, an administrator can enable or disable tunnels 
between two extranet switches (e.g., branch to branch 
communication) , between two users tunneling to the same 

10 switch (e.g., end user to end user), and between a user and 
a branch office tunneling to' the same switch. 

Referring to FIG. 10, an ' administrator can bulk 
configure the SNMP traps reported by the switches and the 
host computers that will receive notification of the traps. 

is SNMP traps allow an administrator to react to events that 
need attention or that might lead to problems. The switches 
allow the scripting of SNMP alerts so that a combination of 
system variables can signal ah SNMP trap. The GUI permits 
the administrator to not only enable or disable different 

20 types of traps, but also to provide the interval between 
execution of the SNMP scripts. 

Referring to FIG. 11, an administrator can also 
configure RADIUS accounting performed by each selected 
switch. RADIUS is a distributed security system that uses 

25 an authentication server to verify dial-up connection 

attributes and authenticate connections. RADIUS accounting 
logs sessions with records containing detailed connection 
statistics., The administrator can enable and disable RADIUS 
accounting, configure the switches to use internal or 

30 external RADIUS servers, and specify how frequently RADIUS 
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records are stored.. By configuring the switches in a 
virtual private network to use the same RADIUS accounting 
methods, switch usage and access can be easily compared 
between the different switches. 
5 Referring to FIG. 12, if enabled, an administrator 

can bulk configure the type, of RADIUS authentication 
performed by the switches. For example, as shown, the 
switches can offer AXENT (AXENT OmniGuard/Def ender) , SecurlD 
(Security Dynamics SecurlD) , MS-CHAP (Microsoft Challenge 

10 Handshake Authentication Protocol encrypted) , CHAP 

(Challenge Handshake Authentication Protocol) , and/or PAP 
(Password Authentication Protocol) authentication. 

The administrator can also define a primary RADIUS 
server and one or more alternate servers. The primary 

"15 server receives all RADIUS authentication inquiries unless 
it is out of service. In the event that the Primary Server 
is unreachable, the Switch will query the alternate RADIUS 
servers. By bulk configuring the servers used to provide 
RADIUS authentication, administrators can quickly route all 

20 RADIUS authentication requests to the same collection of 
RADIUS servers . 

Referring to FIG. 13, switches may use LDAP 
authentication in addition to or in lieu of. RADIUS 
authentication. An external LDAP Server such as the 

25 Netscape Directory Server can store remote access profiles. 
The switch queries the LDAP Server for access profile 
information when a user attempts to establish a tunnel 
connection. The Master LDAP Server is the primary server to 
process queries. Should the "Master server become 

30 unavailable, the switch attempts to initiate a connection 
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with the Slave servers . Bulk configuring different switches 
to use the same LDAP servers both eases the burden of switch 
management on the administrator and reduces the likelihood 
the administrator will inadvertently specify a different 
5 LDAP hierarchy on different switches. 

After completing the bulk configuration wizard, the 
manager stores the specified configuration information, but 
does not transmit the information until the administrator 
specifically exports the configuration data. This provides 
10 administrators with a safeguard against accidentally bulk 
configuring the switches with unintended characteristics. 

Reporting Capabilities 

Referring to FIG. 14, in addition to configuring 

15 multiple extranet switches 100a, 100b, switch manager 
instructions 116 can also produce reports describing the 
extranet switches 100a, 100b in a virtual private network 
102. As shown, the extranet switches 100a, 100b can 
transmit configuration, capacity, and activity information 

20 for inclusion in a report. . 

Referring to FIG. 15, switch manager instructions 
116 can transmit a script 152a, 152b that includes script 
commands requesting current switch 100a, 100b information. 
For example, a script command of "call omGET using 

25 ( "security . trustedFTPenabled" ) " requests information 
describing whether an extranet switch 100a, 100b is 
currently configured to accept FTP (File Transfer Protocol) 
requests from a trusted computer. Appendix B includes a 
sample script requesting information from a Contivity™ 

30 switch. 
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The switch 100a, 100b script interface 138a, 138b 
processes the script commands 128 and produces a file 150a, 
150b including the requested information. The script 
interface 138a, 138b on the switch 100a, 100b can store the 
5 file in a pre-determined directory. The switch manager 
instructions 116 can then use FTP to retrieve the 
information 150a, 150b. 

Again, a wide variety of other techniques could 
enable the switches 100a, 100b to communicate with the 
10 switch manager instructions 116. Additionally, instead of 
the request /response model described above, the switches 
100a, 100b could schedule periodic execution of a script 
and/or periodic transmission of the switch information 150a, 
150b. 

15 Referring to FIG. 16, the switch manager GUI can 

provide a menu of different reports that can be produced for 
selected extranet switches. The manager prepares the report 
by analyzing and/or including data imported from the 
different extranet switches. 

20 Referring to FIG. 17, a first report can display 

different static attributes of the selected switches such as 
DNS details. 

Referring to FIG. 18, a security report displays the 
security configurations of the selected switches such as the 
25 enabling/disabling of different tunneling and communication 
■protocols. The security report can also list changes made 
to the selected switch configurations when such changes 
occurred (not shown) . The report can also include 
information summarizing failed access attempts to the 
30 switches (not shown) . This report enables an administrator 
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to quickly view the different security configurations and 
any troublesome security statistics. 

Referring to FIG. 19,' a capacity report shows the 
current total capacity of tunnels that selected switches can 
5 provide and the total number of subscribers and/or users 

configured to use the switch. This report provides a simple 
but useful gauge of tunnel capacity. Based on the capacity 
report, an administrator can decide whether to add more 
subscribers to an available tunnel pool or to increase the 

10 size of tunnel pool, for example, by upgrading or adding an 
extranet switch. 

Referring to FIG. 20, a trending report displays the 
number of tunnels for each tunnel technology provided by the 
different extranet switches over a user-specified amount of 

15 time. The report allows subscribers to select any number of 
currently defined switches or services. 

Custom Views 

Referring to FIG. 21, the switch manager GUI eases 
20 administration of a virtual private network extranet 

. switches by collecting information about the entire network 
in a single display. As shown, the switch manager GUI 
displays configuration information imported from one or more 
extranet switches (e.g., via the import mechanism described 
25 in conjunction with FIG. 15) . The GUI uses a split screen 
display that includes a .navigation pane 200 listing 
different virtual private network switches 202, subscribers 
204, and other information such as periodic scheduling 206 
of management functions and scripts 208 that can perform 
30 these functions. As shown, the listing uses a hierarchical 
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tree to display the virtual private 'network elements. An 
administrator can view a listed element in more detail by 
expanding the tree (e.g.,. clicking on the " - " or " + " next to 
an element) . The tree display enables an administrator to 
5 quickly find, add, remove, and configure different virtual 
private network extranet switches. 

As shown, the display also provides a tabbed dialog 
control 210 that provides more information and management 
options for a virtual private network element currently 

10 selected in the navigation pane 200 (e.g., "Configuration 
Data" 212) . The .control 210 includes dialogs for adding new 
elements to the tree from a palette. 214 of elements, for 
viewing and altering -properties 216 of a selected element, 
for a list of wizards 218 that perform tasks frequently used 

is with a selected element, and a list of network links 222 
that enable an administrator to manually configure an 
individual extranet switch. By providing management options 
corresponding to an element selected in the navigation pane 
2 00, the GUI presents only a relevant subset of a wide 

20 variety of different management features at a given moment. 
Referring to FIGS. 22-26, the GUI enables an 
administrator to quickly view and modify the configuration 
of any particular switch in the virtual private network from 
within a single application. For example, as shown, an 

25 administrator can quickly add a new subscriber 226 to the 
virtual private network. Briefly, a subscriber is any 
entity that uses a virtual private network service (e.g., a 
tunnel protocol) . For example, service providers typically 
use the same extranet switch to provide virtual private 

30 network services to different organizations. In this case, 
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each organization could be considered a subscriber. 
Subscribers can also be individual users. 

As shown in FIG. 22, after selecting the 
."Configuration Data" element 212^ a palette tab presents 
5 different elements that can be added to the selected virtual 
private network element 212. A new subscriber 226 can be 
added by dragging -and -dropping the subscriber 224 palette 
tool onto the "Configuration Data" element 212. As shown in 
FIG. 23, the administrator can rename the new subscriber 
10 226. As shown in FIG. 24, by selecting the new subscriber 
226, selecting the "palette" tab 214, and dragging a "VPN 
Service" 228 (e.g., a tunnel) from the palette onto the new 
subscriber 226, the administrator can also configure a 
switch or switches to offer a particular tunneling protocol. 

15 . 

As shown in FIG. 25, the administrator can name the 
tunnel, define the tunneling technology used by the tunnel 
(e.g., L2TP) , and enter the tunnel starting and ending 
points which, as shown, are extranet switches. 

20 As shown in FIG. 26, after configuring different 

subscribers and switches, the GUI provides an administrator 
with a variety of different methods of looking at a virtual 
private network. For example, as shown, by expanding a 
subscriber 232 an administrator can quickly see shortcuts to 

25 the extranet switches 236, 238 offering tunnels for 

subscriber use. Alternatively, as shown in FIG. 27, the 
administrator can view the tunneling technologies offered by 
a particular switch 240 by using the navigation pane 200 to 
select the switch's tunnel element 242. The properties 
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dialog 244 displays the configuration of the different 
tunneling technologies. 

The different presentations of the data (e.g., 
subscriber based and switch based) described above enable 
5 the administrator to both ensure ■ that subscribers are 
adequately served and that individual switches are 
configured as desired. 

Referring to FIGS. 28-29, the process described 
above (i.e., selecting an element from the tree and using 

10 the tabbed dialog to view and modify the element/ s 

characteristics) can be used to configure a variety of 
virtual private network characteristics. For example, by 
' selecting a switch 240 from the navigation pane 200, the 
administrator can view and modify the switch's 240 

is characteristics. As shown in FIG. 28, an administrator can 
add RADIUS Authentication 244 to a switch 24 0 by 
dragging-and-dropping the RADIUS Authentication Server 
palette selection 242 onto the selected switch 240. As 
shown in FIG. 29, the administrator can then set different 

20 RADIUS authentication settings for the switch 244. ■ An 
administrator can use a similar technique to add and/or 
configure SNMP (Simple Network Management Protocol) 
settings, switch interfaces to private and/or public 
networks, Ethernet settings, IPX (Internetwork Packet 

25 Exchange) settings, and other extranet switch features 
displayed in the switch palette. Appendix C includes 
screenshots of the different palette elements and their 
properties that can be used to configure an extranet switch. 

The alterations to the switches, for example, adding 

30 RADIUS authentication to a switch, while immediately 



represented to the administrator, is not exported until 
explicitly requested by the administrator. Again, this 
gives the administrator a chance to avoid unintended 
modifications . 
5 Referring to FIGS. 3 0-31, beyond viewing and 

modifying- switch characteristics, an administrator can use 
the GUI to organize information for easy access and 
identification of different elements. For example, as shown 
in FIG. 30, an administrator can drag a folder 250 from the 

10 palette onto an element. The administrator can rename the 
dragged folder 252 (e.g., to "Subscribers") and 
drag-and-drop different subscribers into the folder 252. As 
shown in FIG. 31, a similar technique enables an 
administrator to organize different switches into different 

is groupings such as switches using LDAP 254 for authentication 
and switches using RADIUS 256. 

Integrated Access to a Switch's Configuration Mechanisms 

As previously described, an extranet switch such as 

20 the Contivity™ switch can include a web-server and different 
network pages (e.g., HTML (HyperText Markup Language) 
documents) that enable an administrator to. individually 
configure an extranet switch. By navigating to a switch 
web-server, an administrator can view and/or modify a 

25 switch's configuration. 

Referring to FIG. 32,. the GUI can present a menu 260 
of network links (e.g., link 268) to web-pages offered by a 
selected extranet switch 270. As shown, the menu 260 
includes a description of the link 272 and a corresponding, 

30 URL (Universal Resource Locator) identifying a web-page 
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offered by a switch. As shown, the URL includes designation 
of a communication protocol (e.g., HTTP (HyperText Transfer 
Protocol) 262, an IP address 264, and the location of a 
particular page at the specified IP address 268. When a 
5 user selects a link from the menu 260, the switch manager 
can transmit an HTTP request for the selected URL. 
Alternately, the switch manager can instantiate or call a 
network browser and pass the selected URL. The GUI prepares 
each URL in the menu 260 by prepending a switch's IP address 

10 264 to a predefined set of web-page locations 266. 

By providing the link menu in conjunction with the 
navigation pane 200, administrators can quickly access a 
desired page on any particular switch and can also quickly 
access the same page (e.g., the users page) on a variety of 

is different switches, one after another. Additionally, the 
menu 2 60 obviates the need to remember the different 
extranet switch URLs or expend the time needed to navigate 
through any menu provided by the switch itself which 
necessitates potentially long waits for information to be 

20 transmitted to the switch manager. 

As shown, the web-pages include pages that control 
how a switch handles users (FIG. 33) , branch offices (FIG. 
34) , packet filters (FIG. 35) , groups of users (FIG. 36) , 
access hours (FIG. 37) , and other information such as a menu 

25 that tailors a web-based configuration session (FIG. 39) . 
Descriptions of the functions of these different web-pages 
is described in the New Oak Communications Extranet Access 
Switch Administrators Guide, pages 82-138 of which are 
incorporated by reference herein. 
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Other Embodiments 

The embodiments described above should not be 
considered limiting. For example, one of skill in the art 
could quickly construct a switch manager that perform the 
5 functions described above using different GUI controls, or a 
different arrangement of GUI controls. 

Additionally, the techniques described here are not 
limited to any particular hardware or software 
configuration; they may find applicability in any computing 

10 or processing environment. The techniques may be- 

implemented in hardware or software, or a combination of the 
two. Preferably, the techniques are implemented in computer 
programs executing on programmable computers that each 
include a processor, a storage medium readable by the 

15 processor (including volatile and non-volatile memory and/or 
storage elements) , at least one input device, and one or 
more output devices. Program code is applied to data 
entered using the input device to perform the functions 
described and to generate output information. The output 

20 information is applied to one or more output devices. 

Each program is preferably implemented in a high 
level procedural or object oriented programming language to 
communicate with a computer system. however, the programs 
can be implemented in assembly or machine language, if 

25 desired. In any case, the language may be a compiled or 
interpreted language. 

Each such computer program is preferable stored on a 
storage medium or device (e.g., CD-ROM, hard disk or 
magnetic diskette) that is readable by a general or special 

30 purpose programmable computer for configuring and operating 
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the computer when the storage medium or device is read by 
the computer to perform the procedures described in this 
document. The system may also be considered to be 
"implemented as a computer-readable storage medium, 
configured with a computer program, where the storage medium 
so configured causes a computer to operate in a specific and 
predefined manner. 

Other embodiments are within the' scope of the 
following claims. 
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